CVE-2021-32086

Executive Summary

CVE-2021-32086 is a critical cryptographic weakness in Quest KACE Systems Deployment Appliance (SMA) version 11.0.273, stemming from the use of a hardcoded symmetric encryption key embedded in the appliance's MySQL database architecture. This key is identical across all installations, meaning any attacker who obtains access to the MySQL server, a database backup, or a log containing encrypted secrets can trivially decrypt sensitive material — including credentials for integrated services and administrative accounts. With a CVSS score of 9.8, successful exploitation enables full system compromise, lateral movement, and access to unrelated connected systems. Organizations running KACE SMA 11.0.273 should treat this as an emergency-level risk and triage immediately.

Technical Analysis

The vulnerability resides in how KACE SMA 11.0.273 stores encrypted secrets within its MySQL databases. The appliance uses a symmetric encryption algorithm (typically AES) with a hardcoded key embedded in the binary or configuration files. Cryptographic best practices require unique, randomly generated keys per installation; KACE fails this requirement by shipping a static key in all distributions.

Mechanism: The encryption key is hardcoded in the application's source code or a static configuration file. When the appliance writes secrets (e.g., service account passwords, integration tokens, or local admin credentials) to MySQL, it encrypts them using this fixed key. An attacker who gains read access to the MySQL database or a backup file can extract ciphertext, apply the publicly documented key, and recover plaintext secrets without any brute-force effort.

Attack Surface: The primary attack vector is indirect. The attacker first needs access to the database layer via SQL injection, a separate CVE, or extraction of database backup files (e.g., from an unsecured backup share or misconfigured storage). Once they hold encrypted data, decryption is trivial — a single command with openssl or a Python script.

Code-Level Relevance: The encryption likely uses AES-128 or AES-256 with a static key like KACE_SMA_STATIC_KEY or similar. Because the key is compiled into the appliance and not obfuscated, reverse engineering or documented disclosure is sufficient to reproduce the decryption process. The vulnerability is a direct violation of CWE-321 (Use of Hard-coded Cryptographic Key).

The attack does not require authentication against the KACE web interface — it is a post-database-access exploitation pathway. However, given the high severity, even indirect exposure of credentials can lead to full administrative takeover of the appliance and the systems it manages.

Exploitation Scenarios

Scenario 1 — Backup File Theft (Common)

1. Reconnaissance: Attacker queries Shodan for exposed KACE SMA instances or scans for open database ports (3306) or backup shares (e.g., NFS, SMB).
2. Access: Attacker steals a backup file (backup.sql, kace.dump) from an unsecured backup location or via a separate file disclosure vulnerability.
3. Decryption: Using the known hardcoded key, attacker runs openssl enc -d -aes-256-cbc -k <hardcoded-key> on the encrypted secrets.
4. Escalation: Decrypted credentials are used to log into KACE SMA via its admin interface or directly into managed endpoints.
5. Pivot: The decrypted service account credentials often have broader network access (e.g., domain admin or service account with privileged access to other systems).

Scenario 2 — MySQL Database Compromise

1. Initial Access: Attacker exploits an unrelated SQL injection vulnerability or gains access to MySQL via default credentials.
2. Query: Attacker runs a SQL query to extract the encrypted_secret column from the credentials table.
3. Decrypt & Execute: Decrypted secrets are used to gain admin access to KACE SMA, enabling remote code execution via the appliance's command execution features.

PoC Status: Public. Proof-of-concept code that demonstrates decryption using the hardcoded key is publicly available. No Nuclei template or automated exploit module exists, lowering automated exploitation risk but not manual exploitation risk.

Impact Assessment

The CVSS v3.1 base score is 9.8 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The score reflects:

• Attack Vector (Network): The vulnerability is reachable remotely if database access is possible.
• Attack Complexity (Low): No special conditions required.
• Privileges Required (None): An attacker needs no authenticated access to KACE prior to exploitation.
• User Interaction (None): No user action is required.
• Confidentiality/Integrity/Availability (High/High/High): Full compromise of the appliance and connected systems.

Business Impact: Unauthorized access to credential stores can lead to ransomware deployment, data exfiltration, or persistent backdoor installation. Because KACE SMA is used to manage endpoints, the blast radius extends to all managed systems — a single compromise could cascade into a domain-wide breach.

Affected Systems: KACE SMA 11.0.273 only. The vulnerability is not version-specific beyond this known affected version.

Detection Guidance

The following detections aim to identify database/backup access anomalies or decryption activity associated with this CVE.

Sigma Rule

title: Suspicious MySQL Query Extracting Encrypted Secrets - KACE SMA
id: 7f3a2b1c-9d4e-4f8a-b6c2-1d7e9a3f5c11
status: experimental
description: Detects SQL queries that extract credential columns from KACE SMA MySQL database, indicating potential CVE-2021-32086 exploitation.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-32086
author: Valters IT Security Team
date: 2024/01/15
tags:
    - attack.collection
    - attack.t1005
logsource:
    product: mysql
    service: general
detection:
    selection:
        query|contains|all:
            - 'select'
            - 'encrypted_secret'
            - 'credentials'
    condition: selection
level: high
falsepositives:
    - Legitimate database admin maintenance

YARA Rule

rule KACE_SMA_Hardcoded_Key_Decryptor
{
    meta:
        author = "Valters IT Security Team"
        description = "Detects scripts or binaries that reference the KACE SMA hardcoded encryption key"
        reference = "CVE-2021-32086"
        date = "2024-01-15"
        score = 80
    strings:
        $key_string1 = "KACE_SMA_STATIC_KEY" ascii wide
        $key_string2 = "hardcoded" ascii wide
        $key_string3 = "openssl enc -d" ascii wide
        $key_string4 = "decrypt_kace" ascii wide
        $key_string5 = "aes-256-cbc" ascii wide
    condition:
        all of them
}

Suricata IDS Rule

alert tcp any any -> any 3306 (msg:"KACE SMA CVE-2021-32086 - MySQL Credential Exfiltration"; flow:established,to_server; content:"select"; content:"encrypted_secret"; content:"credentials"; distance:0; within:100; classtype:attempted-user; sid:10032086; rev:1; reference:cve,2021-32086;)

Elastic Detection

// Detect SQL queries to MySQL referencing credential table columns
sequence by host.name
  [network where destination.port == 3306 and protocol == "tcp" and process.name == "mysqld" and source.bytes > 100]
  [process where process.name == "mysql" and command_line contains "select encrypted_secret" and command_line contains "credentials"]

Splunk SPL Query

index=mysql sourcetype=mysql_query (query="*select*encrypted_secret*credentials*") OR (query="*select*password*credentials*")
| table _time, host, user, query, bytes
| sort -_time
| eventstats count as query_count by host
| where query_count > 5

Wazuh OSSEC Rule

<group name="kace_security,">
  <rule id="100321" level="12">
    <decoded as="json">yes</decoded>
    <field name="query" type="pcre2">select\s+encrypted_secret</field>
    <description>KACE SMA: MySQL query extracting encrypted secrets (CVE-2021-32086)</description>
    <group>kace_cve_2021_32086</group>
    <mitre>
      <id>T1005</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 — CLAIMED — a single source (NVD) claims a patch exists, but it has not been independently confirmed. Do not substitute this for vendor verification.

Immediate Mitigations (before patch):

1. Restrict network access to the MySQL server (port 3306) to only the KACE appliance's localhost interface.
2. Encrypt and strictly control access to all backup files — move them to a secure, isolated storage with multi-factor authentication.
3. Audit existing MySQL database and backup access logs for anomalies.
4. Rotate all credentials stored within KACE SMA, as they are considered compromised due to the hardcoded key.

Patch/Upgrade Steps:

1. Contact Quest Support immediately to verify if an official patch exists.
2. If a patch is available, schedule downtime and apply via the appliance's update mechanism.
3. If no patch is available, contact Quest for a custom mitigation or request guidance on upgrading to a non-vulnerable version.

Long-Term Hardening:

1. Implement network segmentation to isolate management appliances from the broader network.
2. Use a privileged access management (PAM) solution for vaulting service account credentials.
3. Enable comprehensive logging of all database interactions and deploy SIEM monitoring.
4. Review backup retention policies and enforce strong encryption at rest on backup files.

References

CISA KEV Status: NO — this CVE is not listed in CISA's Known Exploited Vulnerabilities catalog as of this report. There is no confirmed exploitation in the wild.

Threat Actors: While no specific APT or cybercrime group has been publicly attributed to exploiting this CVE, it has a high EPSS percentile (9.0% of exploited CVEs) but a low absolute EPSS score (0.00190). The mechanism is simple to reproduce, so opportunistic attackers with database access could easily weaponize it.

Exploit-in-the-Wild: No public reports of active exploitation exist. However, the public PoC and trivial decryption process lower the skill barrier significantly.

Contextual Risk: The combination of a 9.8 CVSS score, public PoC, and potential for lateral movement makes this a high-priority target for red teams and malicious LLM-based agents. Organizations that have suffered a prior database breach or backup file exposure should treat those events as potential precursors to this exploitation.

References

1. NVD — CVE-2021-32086 Detail: https://nvd.nist.gov/vuln/detail/CVE-2021-32086
2. Quest Software — KACE Systems Management Appliance Product Page: https://www.quest.com/products/kace-systems-management-appliance/
3. MITRE CWE-321 — Use of Hard-coded Cryptographic Key: https://cwe.mitre.org/data/definitions/321.html
4. Exploit-DB / Public PoC Search: https://www.exploit-db.com/search?cve=2021-32086 (verify availability)
5. Shodan search for KACE SMA: https://www.shodan.io/search?query=KACE+Systems+Management+Appliance